Where apps hide your files

Finding the ~/.aws folder

Updated 2026-10-28 · 5 min read

The AWS CLI stores your access keys and profile settings in two plain-text files inside a hidden .aws folder in your home directory. You can find the files, see which profiles exist and check permissions without ever printing a secret.

The location

~/.aws/credentials
~/.aws/config

Both are plain text with no extension, in a hidden folder in your home directory. AWS's documentation says aws configure stores the sensitive credentials in credentials and the less sensitive settings in config, both in the .aws folder of your home directory ($HOME or ~ on macOS). You can point to other locations with the AWS_SHARED_CREDENTIALS_FILE and AWS_CONFIG_FILE environment variables.

Open the folder from Terminal:

open ~/.aws

Or in Finder choose Go > Go to Folder (⇧⌘G) and paste ~/.aws.

On the Mac used for this guide, ~/.aws holds exactly those two files, both with permissions -rw------- (readable only by the owner), and no subfolders yet. Their contents are not shown here and should not be shown anywhere.

What goes in each file

File	What it holds	Sensitive?
credentials	Access key ID and secret access key for each profile, and a session token for temporary credentials	Yes, never share
config	Region, output format, role and SSO settings per profile	Lower risk, but can reveal account IDs and role names

Both use sections in square brackets, and the profile naming differs between them, per the AWS docs: in config a named profile is written [profile name] and the default is [default]; in credentials it is written [name], and the docs say not to use the word profile there. Mixing these up makes a profile appear to be missing.

The config file can hold keys too. If a profile with the same name has keys in both files, the AWS documentation says the keys in credentials take precedence, and it suggests keeping keys in credentials. The AWS SDKs read the same files, so a Python or Node script on your Mac may be using these keys as well.

List your profiles without printing secrets

Use the CLI, which reads the files for you:

aws configure list-profiles
aws configure list

aws configure list-profiles prints profile names only. aws configure list shows the settings in use and where each came from, with all but the last four characters of each key masked; treat its output as sensitive anyway and do not paste it publicly. To check the files themselves, list names, sizes and permissions only:

ls -la ~/.aws

Do not run cat on credentials. If you must inspect it, open it in an editor on your own screen, not in a screen share, a chat or a pasted terminal log.

If the folder is not there, or has more in it

On a new Mac the folder appears the first time you run aws configure or aws configure sso. Two cache folders can appear later, and the AWS documentation names both:

• ~/.aws/sso/cache holds the token from an IAM Identity Center (SSO) sign-in.
• ~/.aws/cli/cache holds temporary credentials the CLI gets when a profile assumes an IAM role, reused until they expire.

Both hold live credentials, so leave them out of zip files and shared backups.

Also check the environment, because AWS tools can take credentials from variables and never touch the files:

env | grep -c '^AWS_'

That prints only a count of AWS_ variables, not their values. A non-zero count means some credentials or settings may come from your shell profile or a tool, not from ~/.aws.

Which CLI is it

Where the aws program lives does not change where your settings live: every install reads the same per-user ~/.aws folder. AWS's own macOS installer puts the CLI in /usr/local/aws-cli and links it at /usr/local/bin/aws. Homebrew's awscli formula is also version 2 of the CLI, linked from /opt/homebrew/bin/aws on Apple silicon or /usr/local/bin/aws on Intel. On the Mac used for this guide, aws is Homebrew's awscli 2.17.39 under /usr/local. Run which -a aws to see every copy on your PATH.

Backing up and moving to a new Mac

Treat credentials like a password list. Do not copy it to a cloud notes app, a repository or an unencrypted USB stick. The safer routes:

• Create a fresh access key for the new Mac in the IAM console, and deactivate the old one.
• Prefer SSO or short-lived role credentials, so there is nothing long-lived to move.
• If you copy the folder, use an encrypted disk image or AirDrop between your own Macs, then check permissions on arrival with ls -la ~/.aws and set them with chmod 600 ~/.aws/credentials ~/.aws/config if needed (this changes permissions only).

Time Machine includes hidden folders in your home, so ~/.aws ends up in your backups; make sure the backup disk is encrypted.

If a key has been exposed

If credentials ever lands in a public repository, a chat or a screenshot, treat the key as compromised: deactivate and delete it in the IAM console, create a new one, and update the file. Removing the file from your Mac does not help once the key has been published.

Why Finder and Spotlight skip it

.aws is a hidden dot-folder, and Spotlight and Finder searches leave hidden folders out. A search for "aws" finds installers and downloads, not your configuration.

Finding it again later

Typing credentials into Everywhere shows every file with that name on the Mac, which is a quick way to spot a stray copy of an AWS credentials file in a project folder or an old backup. Hidden folders in your home are covered as they are; copies in Documents, Downloads or on the Desktop appear once Everywhere has Full Disk Access. Press ⌘↵ to reveal a match in Finder rather than previewing it, since a preview would display the keys. It searches file names only, never the keys inside.

Common questions

Where is the AWS credentials file on a Mac?

At ~/.aws/credentials, with settings in ~/.aws/config. The .aws folder is hidden, so use Go to Folder (⇧⌘G) or open ~/.aws.

How do I list my AWS profiles without showing keys?

Run aws configure list-profiles. It prints profile names only.

Why does my profile not work in the config file?

In ~/.aws/config named profiles are written [profile name], but in ~/.aws/credentials they are written [name]. Using the wrong form hides the profile.

Can I store the AWS files somewhere else?

Yes. Set AWS_SHARED_CREDENTIALS_FILE and AWS_CONFIG_FILE to the paths you want, and the CLI reads those instead.